AZL-99588 CVE-2026-80847 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCPMINMSS tcpselectinitialwindow assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAXADVMSS is one way to get...

CVE-2026-80847

In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCPMINMSS tcpselectinitialwindow assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAXADVMSS is one way to get...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: sched: Fixed out-of-bound access in uclamp. Util-clamp places tasks into different buckets based on their clamp values for performance reasons. However, the size of the buckets is currently computed using a rounding division, whi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfs: Only call foliostartfscache once for each folio. If a network filesystem using netfs implements a clamplength function, it can set subrequest lengths that are smaller than the page size. When we loop through the folios in...

CVE-2026-74497

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

UBUNTU-CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72502 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72465 xprtrdma: Sanitize the reply credit grant after parsing

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

EUVD-2026-59225

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72326

CVE-2026-72326 affects the Linux kernel’s net/sched cake scheduler. CAKE accepts signed overhead values stored in an s16, but the adjusted packet length calculation uses unsigned arithmetic, allowing a negative effective length to wrap to a large value. This can cause rate accounting to depend on...

PT-2026-72999

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix busy-loop and I2C flooding in update thread When userspace configures 'auto update interval' to 0 via sysfs, the background kthread executes schedule timeout interruptible0, which returns immediately. If 'num...

CVE-2026-68411 wifi: mac80211_hwsim: clamp virtio RX length before skb_put

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

EUVD-2026-55467

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

CVE-2026-68366

The CVE concerns the Linux kernel USB gadget UVC path. In uvc_send_response, the code builds a control response from a user-supplied uvc_request_data and sets req->length = min(uvc->event_length, data->length). The operation then memcpy(req->buf, data->data, req->length). Since ...

CVE-2026-71202

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...

CVE-2026-69079

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...

CVE-2026-69079 Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...

CVE-2026-69079

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...